Mallary Openclaw Skill

• Outcome: Pass
• Latest audit: Oct 9, 2026 · 1:24 PM UTC
• Version: 1.1.6

Overview

This is a coherent Mallary CLI skill that discloses its social posting and account-management powers, with meaningful safety boundaries and some user-review caveats.

Install this only if you trust Mallary and are comfortable granting the CLI broad access to connected social accounts. Prefer a pinned or reviewed CLI version over one-off unpinned npx use, keep API keys in a secret manager, and personally verify profile, destination, content, media, and timing before asking an agent to publish or change account state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

mallary auth status

text

Show the user only the Mallary verification URL and one-time code, then wait for browser approval. Never ask the user to paste a password, API key, access token, or refresh token into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.

`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. It is a bearer secret. If the user intentionally chooses an API key:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Using npx @mallary/cli without a pinned version causes execution of whatever package version is current at runtime, which weakens supply-chain integrity and reproducibility. If the package is compromised, unpublished/replaced, or a breaking release is published, users may execute unreviewed code directly on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The unpinned npx @mallary/cli command allows fetching and running the latest package version at execution time, introducing avoidable supply-chain risk. A malicious or compromised upstream release could lead to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Referencing npx @mallary/cli for operational commands without version pinning means the executed code is not fixed or reproducible. This increases the attack surface for package-registry compromise and makes security review of the documented workflow unreliable.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · HOW_TO_RUN.md (reported line 160)May include surrounding context.

bash

mallary --help
node cli/dist/index.js help posts create

Test with Safe Read-Only Commands (requires API key)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · HOW_TO_RUN.md (reported line 249)May include surrounding context.

If you want a shorter command:

bash

# Add to ~/.bashrc or ~/.zshrc
alias my='mallary'

# Now you can use

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The production deployment section recommends npx @mallary/cli --help without version pinning, which still executes remote package code on demand. In a CLI that handles bearer API keys and can publish content, this makes the supply-chain issue more consequential than a purely local utility.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The summary table repeats an unpinned npx @mallary/cli ... invocation, reinforcing a pattern that encourages executing whatever version is current in the registry. This is a genuine supply-chain weakness because npx can run newly published code without a prior trusted installation step.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · PROVIDER_SETTINGS.md (reported line 20)May include surrounding context.

mallary platforms list --profile-id

text

Profile IDs, profile names, account labels, and connection state are sensitive. Minimize and redact the output. Never reuse an older profile ID or connection snapshot as current state without checking it again.

## If the User Explicitly Requests a Provider-Specific Post or Proposal

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · QUICK_START.md (reported line 56)May include surrounding context.

mallary platforms list --profile-id

text

Profile IDs, profile names, account labels, and connection state are sensitive. Minimize and redact the output. Never reuse an older profile ID or connection snapshot as current state without checking it again.

## If the User Explicitly Requests a Provider-Specific Post or Proposal

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

mallary platforms list --profile-id

text

Profile IDs, profile names, account labels, and connection state are sensitive. Minimize and redact the output. Never reuse an older profile ID or connection snapshot as current state without checking it again.

## If the User Explicitly Requests a Provider-Specific Post or Proposal

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx @mallary/cli --help without a pinned version executes whatever package version is current at runtime, creating a supply-chain risk. In an agent or CI context, this can lead to unintended execution of a compromised or breaking release with the user's privileges.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · QUICK_START.md (reported line 26)May include surrounding context.

mallary auth status

text

Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask them to paste a password, OAuth token, or API key into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.

`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, load it from a masked secret store, never print it, and never paste it into a prompt. When set, it takes precedence over stored OAuth.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

mallary auth status

text

Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask them to paste a password, OAuth token, or API key into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.

`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, load it from a masked secret store, never print it, and never paste it into a prompt. When set, it takes precedence over stored OAuth.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

mallary auth status

text

Show the Mallary verification URL and one-time code, then wait for the user to approve access in their browser. Never ask them to paste a password, OAuth token, or API key into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.

`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. If the user chooses it, load it from a masked secret store, never print it, and never paste it into a prompt. When set, it takes precedence over stored OAuth.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The instruction to execute a requested publish/reply action 'without asking for another confirmation' reduces friction around state-changing operations and can cause an agent to perform external actions based on a single ambiguous or manipulated request. In a delegated-agent setting, this weakens human-in-the-loop safeguards for posting, scheduling, or replying on connected accounts.

Content

Scanner excerpt · QUICK_START.md (reported line 66)May include surrounding context.

md

1. use minimum read-only discovery to resolve the current profile and destination
2. ask only for a material detail that is missing or ambiguous
3. execute the requested action once without asking for another confirmation
4. verify the result with a read-only command

An OAuth setup or discovery request is not a request to post. For deletion, disconnection, or another destructive account action, follow the stronger safeguards in [SKILL.md](./SKILL.md).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

The instruction to execute requested publishing, scheduling, upload, or reply actions 'without asking for another confirmation' explicitly reduces human approval gates before state-changing operations. In an agent skill, this can enable unintended writes if the user's request is ambiguous, spoofed, or lacks critical context.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

- begin with the lowest-risk read-only command that can answer the request
- request the minimum data needed and redact sensitive operational output before sharing it
- never use a data-transmitting or state-changing action as a setup, authentication, or smoke test
- if the user clearly requests publishing, scheduling, an upload for that post, or a reply, follow [SKILL.md](./SKILL.md), resolve any missing material detail, and execute without asking for another confirmation
- run a requested action once and verify it with a read-only command

Installation, authentication, or discovery alone is not a request to publish or change Mallary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README recommends invoking the package through npx without pinning an exact version. That allows execution of whatever version is current at install time, increasing supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx @mallary/cli --help executes an unpinned package directly from the registry. In an agent context, this creates a realistic risk of running an unexpected or malicious version during setup or discovery.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

mallary auth status

text

Show the user only the Mallary verification URL and one-time code, then wait for browser approval. Never ask the user to paste a password, API key, access token, or refresh token into chat. Do not ask the user to choose scopes or add scope flags. OAuth access does not publish or change anything during setup.

`MALLARY_API_KEY` remains an optional fallback for CI or another environment where OAuth is not practical. It is a bearer secret. If the user intentionally chooses an API key:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

This instruction authorizes the agent to perform external state-changing actions such as publishing, scheduling, uploading media, or replying without a final execution-time confirmation once it interprets the user's request as clear. That creates a real autonomy risk: ambiguous phrasing, prompt injection via referenced content, or mistaken destination/content resolution could cause unintended public posting or remote account changes.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

1. Use read-only discovery to resolve the exact target.
2. Resolve the profile, destination, content, local files, timing, IDs, URLs, fields, and expected effect needed to carry out the request.
3. If a material detail is missing or ambiguous, ask only for that detail. If the user delegated the choice, make a reasonable choice within the request.
4. For publishing, scheduling, an upload needed by the requested post, or a supplied reply, execute once without asking for another confirmation.
5. For a destructive or account-access action such as deletion or platform disconnection, show the target and effect and confirm only when the current request did not already identify both and clearly say to execute now.
6. Verify the result with a read-only command. Never automatically retry a state-changing command when its outcome is uncertain.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SUPPORTED_FILE_TYPES.md (reported line 119)May include surrounding context.

md

- **Unsupported file type:** confirm the real extension and compare it with the tables above.
- **MIME mismatch:** verify that the extension matches the actual file contents; do not fix this by renaming alone.
- **File not found:** verify the path locally without transmitting the file.
- **No permission:** confirm that the current user can read the file without changing broad filesystem permissions.
- **Authentication error:** ask the user to restore the API key outside chat; never request or print the key.
- **Uncertain remote result:** inspect existing Mallary state and do not repeat the transfer automatically.

Static analysis

No suspicious patterns detected.